发现对抗攻击下检测数量与精度可分离，导致防御失效。
Fluently Lying: Adversarial Robustness Can Be Substrate-Dependent
- 提出质量退化新现象：检测数不变但精度暴跌。
- 在EMS-YOLO上，mAP从0.528降至0.042，检测数仍超70%。
- 现有防御方法均失效，提示防御依赖特定模型结构。
主流对抗攻击监测与防御方法假设精度下降时检测数量同步减少，这一假设未被实证。我们发现一个反例：在单个模型上，使用标准PGD攻击时，基于脉冲神经网络（SNN）的EMS-YOLO检测器保留超过70%的检测数，但mAP从0.528骤降至0.042。我们将其称为“质量退化”（Quality Corruption, QC），以区别于普遍存在的抑制型失败。在四个SNN架构和两种威胁模型（l-infinity与l-2）中，仅EMS-YOLO出现QC。五种标准防御组件均未能识别或缓解此现象，表明当前防御体系可能依赖于对单一模型结构的假设。这是首个证据表明对抗失效模式具有模型依赖性。
原文摘要 · Abstract (English)
The primary tools used to monitor and defend object detectors under adversarial attack assume that when accuracy degrades, detection count drops in tandem. This coupling was assumed, not measured. We report a counterexample observed on a single model: under standard PGD, EMS-YOLO, a spiking neural network (SNN) object detector, retains more than 70% of its detections while mAP collapses from 0.528 to 0.042. We term this count-preserving accuracy collapse Quality Corruption (QC), to distinguish it from the suppression that dominates untargeted evaluation. Across four SNN architectures and two threat models (l-infinity and l-2), QC appears only in one of the four detectors tested (EMS-YOLO). On this model, all five standard defense components fail to detect or mitigate QC, suggesting the defense ecosystem may rely on a shared assumption calibrated on a single substrate. These results provide, to our knowledge, the first evidence that adversarial failure modes can be substrate-dependent.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。